# Infor XA Secure Net-Link Setup and Upgrade Checklist

> Source: https://netray.co/tools/infor-xa-secure-net-link-setup-checklist
> Publisher: Netray (netray.co), AI and integration engineering for ERP and manufacturing systems.
> Section: Free Tools

## Short answer

A step checklist for deploying or redeploying Net-Link for Infor XA 9.2 and 10 in Apache Tomcat or IBM WebSphere, securing it with TLS and verifying it before users switch.

## Category

other-erp

## Erp

Infor XA

## Audience

- ERP administrator
- IBM i administrator
- Network engineer

## Tool

**Kind:** checklist

**Groups:**

#### Prerequisites

**Items:**

**Text:** XA release (9.2 or 10) and current IDF build level recorded for the environment

**Critical:** true

Servlet container chosen: Apache Tomcat (for example the SiWA Windows install) or IBM WebSphere on IBM i

**Text:** Topology agreed: users outside the network reach the web components, not the IBM i directly

**Critical:** true

**Text:** Fully qualified domain names in place for the IBM i and any Windows server, known both internally and externally

**Critical:** true

TLS certificate available in the IBM i system certificate store (or Windows store for Tomcat)

Port plan written down: IDF HTTP port (36001 in the Infor examples), Net-Link port, SiWA port

Subsystem QHTTPSVR running with the ADMIN jobs active (STRTCPSVR SERVER(*HTTP) HTTPSVR(*ADMIN) if not)

#### Generate the WAR file

**Items:**

**Text:** XA 10: sign in to Net-Link for the correct environment, then open http://server:port/NetLink/WebArchive to download NetLink.war

**Critical:** true

XA 9.2: download from http://server:port/NetLink/NetLink.war, noting it reflects the global IDF build

If generation returns 'Exception Encountered' on an older release, build the WAR manually and replace the example host name in WEB-INF/web.xml with your IBM i FQDN

**Text:** WAR regenerated after every new IDF build is applied

**Critical:** true

Previous NetLink.war kept as the rollback copy

#### Deploy to Tomcat or WebSphere

**Items:**

Tomcat: stop the SiWA service, copy NetLink.war to the webapps folder, restart and confirm Tomcat unpacks it

WebSphere: copy the WAR to a scratch folder in the IFS

WebSphere: in HTTPAdmin (port 2001) signed on with *SECADM authority, create the application server (suggested NLAPPSVR) and a new HTTP server (suggested NLWEBSVR)

WebSphere: install the WAR with context root /NetLink and the web server box checked

Port clash warning handled: new unused port added in General Server Configuration and in the virtual host aliases, old port removed

Redeploy: stop HTTP and application servers for SiWA and Net-Link, use Update on the installed application, then restart

#### Security

**Items:**

**Text:** Configure TLS wizard run for the Net-Link HTTP server with 'disable non-SSL' selected

**Critical:** true

Certificate selected from the system certificate store and servers restarted

Reverse proxy set in the WSANYWHERE httpd.conf (proxy_module, proxy_http_module, ProxyPass /NetLink) so SiWA and Net-Link share one host and port

httpd.conf backed up before editing; SSLProxyAppName matches the SSLAppName

**Text:** Firewall allows only the HTTPS port from outside; HTTPAdmin port 2001 not exposed

**Critical:** true

No default or shared passwords on HTTPAdmin or the WebSphere console

#### Rollout and go-live verification

**Items:**

**Text:** Secured Net-Link URL saved in SiWA Admin under Workspace Configuration, Net-Link

**Critical:** true

HTTP threads and WebSphere web container threads raised for the user base (Infor guide: users x 125%, web container 10 higher)

Test users per role sign in; XA security areas unchanged

Key tasks run end to end: customer order entry, MO release, item inquiry

Printing and report output checked from Net-Link sessions

Response time compared with the previous setup at peak hours

**Text:** Rollback steps tested: previous WAR and httpd.conf restore

**Critical:** true

**Scoring Note:** Critical items protect access and security. Do not switch users to the new Net-Link until every critical item is ticked; non-critical gaps can be closed in the first week.

## Content

**Intro:** A checklist for installing or upgrading Net-Link and Secure Net-Link for Infor XA 9.2 and 10, following the steps in Infor's Setup Guide for Secure Net-Link. It covers WAR generation, deployment to Apache Tomcat or IBM WebSphere, TLS, the SiWA reverse proxy and go-live checks.

**Sections:**

#### Where Net-Link fits

**Body:** Net-Link is the browser interface to XA, built on IDF. In a standard install users reach it through a URL on the IBM i, which keeps them inside the network. When users outside the network need access, Infor's guidance is not to expose the IBM i directly but to run the Net-Link web components in a servlet container, Apache Tomcat or IBM WebSphere, packaged as a WAR file. The WAR contains configuration for talking to the IBM i, which is why it is generated from your own environment rather than shipped with IDF. The container used for System i Workspace (SiW Anywhere) can host it as well.

#### How to use the checklist

**Body:** Work through the groups in order and tick items as they are done; export the result to keep with the change record. On an upgrade, repeat the WAR group and the redeploy item whenever a new IDF build is applied, because an old WAR can carry components that no longer match the server. Record the ports you use: the Infor examples use 36001 for IDF HTTP and show how to move Net-Link to a new port when the wizard warns of a clash. Critical items are the ones that, if skipped, leave the system exposed or users unable to sign in.

#### TLS, reverse proxy and threads

**Body:** Run the Configure TLS wizard in HTTPAdmin for the Net-Link HTTP server, choose to disable non-SSL access, select the certificate from the system store and restart. Infor recommends that SiWA and Net-Link use the same host and port, done with a reverse proxy in the WSANYWHERE httpd.conf: load proxy_module and proxy_http_module and add ProxyPass and ProxyPassReverse for /NetLink inside the SSL virtual host. Then set the secured URL in SiWA Admin. The guide also notes that IBM default thread counts can be too low: HTTP server threads default to 40 and web container threads to 50, and the guide suggests users x 125% for HTTP threads and 10 more for the web container.

#### Common mistakes

**Body:** Most failed deployments trace back to host names: if the IBM i and Windows server do not have proper FQDNs before System i Workspace is installed, URLs and SSL settings are created wrong. Other frequent problems are deploying a WAR downloaded from the global environment when the user's environment is on a different build, forgetting to update the Net-Link URL in SiWA Admin after enabling TLS, and leaving port 2001 reachable from outside. Keep the previous WAR and httpd.conf so you can roll back in minutes.

**Cta:** If you are opening XA to users outside the network and also want a private AI assistant behind the same secure front end, we can design both together on your own servers.

**Faq:**

#### How do I get the NetLink.war file for Infor XA 10?

**Answer:** Sign in to Net-Link for the environment that has the correct build, then in the same browser session open http://server:port/NetLink/WebArchive, where server is the IBM i hosting IDF and port is the IDF HTTP port. The NetLink.war file is generated from that environment and downloaded.

#### Can Net-Link run in Tomcat instead of WebSphere?

**Answer:** Yes. Infor's guide covers Apache Tomcat, typically the Tomcat used by a SiWA Windows install, and IBM WebSphere 8.5 and 9.x on IBM i. For Tomcat you stop the SiWA service, copy NetLink.war into the webapps folder and restart, and Tomcat deploys it automatically.

#### Do I need to redeploy Net-Link after applying an IDF build?

**Answer:** Yes. The WAR file contains components that can change with each IDF build, so Infor recommends refreshing it whenever a new build is applied. Regenerate the WAR, replace it in Tomcat or use Update on the installed application in WebSphere, and restart the HTTP and application servers.

#### How many threads should Secure Net-Link have?

**Answer:** Infor's guide notes IBM defaults of 40 HTTP server threads and 50 web container threads, which can be too low. It suggests setting HTTP threads to about your user count x 125% and the web container to 10 more. Save the WebSphere master configuration and restart both servers.

## Search terms

infor xa netlink, infor xa net-link, infor erp xa net-link, infor xa release 10, netlink.war deployment, secure net-link websphere, xa net-link tls, siwa net-link url

---
Talk to an engineer: https://netray.co/contact?intent=erp_ai | Machine catalog: https://netray.co/agent/catalog.json